The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The LateChunker class implementation in references/chunking-strategies.md utilizes trust_remote_code=True within the AutoModel.from_pretrained call. This setting allows the execution of arbitrary Python code contained within the model repository on Hugging Face, creating a significant security risk if the repository is compromised or points to an untrusted source.
[PROMPT_INJECTION]: The skill processes untrusted document content for RAG pipelines but fails to implement robust boundary markers when interpolating this data into LLM prompts. In references/rag-evaluation.md, the evaluate_with_llm function embeds raw retrieved context and answers directly into user messages without delimiters or sanitization, creating a surface for indirect prompt injection attacks.
[COMMAND_EXECUTION]: The skill provides examples of interacting with databases and remote APIs (OpenAI, Cohere, Pinecone, Qdrant) using user-defined inputs. While instructional, these patterns represent an attack surface if an agent executes these operations on unvalidated external data.

rag-architect